N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Allow traffic from Outside to DMZ on port 443

  Why this is correct

  This firewall rule explicitly permits inbound connections originating from the "Outside" network (representing the public internet) to destination IP addresses within the "DMZ" (Demilitarized Zone). By specifying port 443, the rule exclusively allows HTTPS traffic, which is the standard secure protocol for web communication. This directly fulfills the requirement to allow secure web access to a server hosted in the DMZ from external users.

• ✗

  Allow traffic from DMZ to Outside on port 443

  Why it's wrong here

  This firewall rule would allow systems within the "DMZ" to initiate outbound connections to the "Outside" network (the Internet) using port 443. This is typically used for services like fetching updates or communicating with external APIs. However, this rule does not permit *inbound* connections from the Outside to the DMZ, meaning external clients would still be unable to establish an HTTPS session with the web server.

  When this WOULD be correct

  This option would be correct if the question required allowing the web server in the DMZ to initiate outbound HTTPS connections to the Internet, for example, to download updates or access external APIs.

• ✗

  Allow traffic from Inside to DMZ on port 443

  Why it's wrong here

  This rule would permit traffic originating from the "Inside" network (representing the internal corporate LAN) to reach servers located in the "DMZ" on port 443. While it would allow internal users to access the web server via HTTPS, it completely fails to address the core requirement of allowing *inbound* HTTPS traffic from the *Internet* (Outside). Therefore, it does not solve the problem of making the web server publicly accessible.

  When this WOULD be correct

  This option would be correct if the question asked for a rule to allow internal corporate users (Inside) to access a web server in the DMZ for management or internal applications.

• ✗

  Allow traffic from Outside to Inside on port 443

  Why it's wrong here

  This rule would permit inbound traffic originating from the "Outside" network (Internet) to directly access resources within the "Inside" network (internal corporate LAN) on port 443. This configuration completely bypasses the security segmentation provided by the DMZ and exposes internal systems directly to the public internet. Such a rule poses a significant security risk and is contrary to the best practice of isolating public-facing services in a DMZ.

  When this WOULD be correct

  This rule would be correct if the web server were located on the Inside interface (corporate network) and the company wanted to allow inbound HTTPS from the internet directly to that internal server, though this is generally discouraged due to security risks.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”